When creating alerts in Splunk, we are trying to use generated field extractions and referencing them within our alert queries. When running the query in Search, there is no error. However, when trying to set an alert for the same query, we receive an error in our logs, stating that the query is in an invalid syntax (looking for the error now, we have since turned those jobs off to clean up our logs).
Any ideas or solutions to this problem would be greatly appreciated! It sounds like I could put the regex into the query, but I'd like to avoid this.